Why does defaultDNS use Quad9's "Unsecured" service? (dns10/9.9.9.10 as opposed to dns/9.9.9.9)

[af3556]

The default upstream DNS server [defaultDNS](internal/dnsforward/dnsforward.go) uses https://dns10.quad9.net/dns-query, which Quad9 describe as:

Unsecured: No Malware blocking, no DNSSEC validation (for experts only!)

I'm wondering what benefits dns10 have over the "secured" https://dns.quad9.net/dns-query for AGH?

[schzhn]

By default, blocking DNS requests should be the responsibility of AdGuard Home, not the upstream DNS server.
Related #1451

[af3556]

So the rationale is "it may be confusing if something other than AdGuard Home is blocking DNS requests", which is fair enough, especially for an out-of-the-box default. Would it be worthwhile making a note in the docs to the effect of "the default upstream is unfiltered Quad9, you may want to consider switching to the standard servers, such as https://dns.quad9.net/dns-query, that provide their own security-focused protections" ?